| System Integration | Virtual Systems |
|---|
| SNMP System Monitoring: | Virtual Systems (FortiOS Virtual Domains) divide a single FortiGate unit into two or more virtual instances of |
|---|
| - SNMP v1and v2c support. | FortiOS that function separately and can be managed independently. - SNMP v3 implementation includes support for queries, traps, authentication, and privacy. Configurable virtual systems resource limiting and management such as maximum/guaranteed ‘active - SNMP traps alerting to events such as a full log disk or a virus detected. sessions’ and log disk quota |
|---|
| Traffic Monitoring: | VDOM operating modes: NAT/Route or Transparent - sFlow version 5 and Netflow V9.0 VDOM security inspection modes: Proxy or Flow-based External Logging: |
|---|
| - Syslog | Policy Objects - Reliable syslog (RAW Profile) based on RFC 3195 |
|---|
| - WebTrends WELF compatible | Policy objects: predefined, customs, object grouping, tagging, and coloring Technology ecosystem encompasses leading partners in the Firewall and Network Risk Management, SDN Address objects: subnet, IP, IP range, GeoIP (Geography), FQDN and Virtualization, Security Information and Event Management (SIEM), Systems Integration, Testing and User Authentication Training, and Wireless markets. Native |
|---|
| Central Management and Provisioning | Single-sign-on: Intergation with Windows AD, Microsoft Exchange Server, Novell eDirectory, FortiClient, Citrix Central management support: FortiManager, FortiCloud hosted service, web service APIs and Terminal Server Agent, Radius (accounting message), POP3/POP3S, user access (802.1x, captive portal) authentication Rapid deployment: Install wizards, USB auto-install, local and remote script execut |
|---|
| Cloud and SDN Integration | renewal of certificates before expiry, OCSP support Integration with Openstack, VMWare NSX, and Cisco ACI infrastructure. Device Identification |
|---|
| Configuration | Device Identification: Device and OS fingerprinting, automatic classification, inventory management Management Access: HTTPS via web browser, SSH, telnet, console Support for MAC Authentication enforcement and bypass |
|---|
| FortiExplorer: | SSL Inspection - Management client for Windows, Mac, IOS, and Andriod platforms |
|---|
| - Ease-of-use by using USB connectivity | Inspect SSL encrypted traffic option for IPS, application control, antivirus, web filtering, and DLP Feature Store: Toggle GUI component displays SSL MITM Mirroring |
|---|
| GUI configuration: | SSL Inspection Method options: SSL certificate inspection or full SSL inspection - ‘One-Click’ access that transfer administrators to next step panels quickly SSL inspection exemption by site reputation DB, web categories, and/or policy addresses - Dynamic object selectors and predictive search queries Web UI administration language support: English, Spanish, French, Portuguese, Japanese, Simplifi |
|---|
| Traditional Chinese, Korean | User notifications: customizable replacement message for block sites and attachments |
|---|
| Visibility | Web Browser top banner insert (Fortinet Bar): shows application control violations, Endpoint control enforcement, web browsing quota etc Dashboard: Customizable widgets that inform administrators of crucial system, licensing threats, and |
|---|
| network status | User quarantine: - Manually assigned with perpetual or customizable duration Interactive and graphical visualizer for user, device, network, and security activities (FortiView): - Automatically when triggered by violated IPS signature - A variety of GUI consoles that display current and historical status using different perspectives such as ‘sources’, ‘destinations’, ‘interfaces’, ‘applications’, |
|---|
| - Threat map | Botnet server IP blocking with global IP reputation database - Data views options: Table, bubble chart, or world map if applicable Antivirus database type selection (on selected models) - Accelerated session indication on ‘All sessions’ FortiView Console Flow-based or proxy-based AV option: - WHOIS Lookup for Public IP addresses within FortiView and log tables. - Support for popular web, mail, and |
|---|
| Log & Report | Option to treat Windows executables in email attachments as viruses File quarantine (local storage required) Logging facilities support: Local memory & storage (if available), multiple syslog servers, multiple FortiAnalyzers, WebTrends servers, FortiCloud hosted service External cloud-based or on-premise file analysis (OS sandbox) integration: - File submission (with option to select types) Reliab |
|---|
| authentications, WiFi related events | signatures, manual, automatic pull or push signature update, threat encyclopedia integration |
|---|
| Brief traffic log format option | IPS Actions: Default, monitor, block, reset, or quarantine (attackers IP, attackers IP and Victim IP, incoming interface) with expiry time IP and service port name resolution option Filter-Based Selection: Severity, target, OS, application, and/or protocol |
|---|
| Diagnostics | Packet logging option Diagnostic CLI commands, session tracer, and packet capture for troubleshooting hardware, system, and IP(s) exemption from specified IPS signatures network issues. IPv4 and IPv6 rate-based DOS protection (available on most models) with threshold settings against TCP Syn |
|---|
| Policy and routing GUI tracer | flood, TCP/UDP/SCTP port scan, ICMP sweep, TCP/UDP/SCTP/ICMP session flooding (source/destination) |
|---|
| Packet flow CLI tracer | IDS sniffer mode Hardware testing suite on CLI Active bypass with bypass Interfaces (selected models) and FortiBridge |
|---|
| Application Control | SSL VPN port forwarding mode: uses a Java Applet that listens on local ports on the user’s computer. When it receives data from a client application, the port forward module encrypts and sends the data to the SSL Host integrity checking and OS check (for windows terminals only) prior to SSL tunnel mode connections |
|---|
| Custom application signature support | MAC host check per portal - Remote peer support: IPsec-compliant dialup clients, peers with static IP/dynamic DNS |
|---|
| SSH Inspection | - Authentication method: Certificate, pre-shared key - IPsec Phase 1 mode: Aggressive and main (ID protection) mode - Peer acceptance options: Any ID, specific ID, ID in dialup user group - IKE mode configuration support (as server or client), DHCP over IPsec |
|---|
| Web Filtering | - Phase 1/Phase 2 Proposal encryption: DES, 3DES, AES128. AES192, AES256 - Phase 1/Phase 2 Proposal authentication: MD5, SHA1, SHA256, SHA384, SHA512 - Phase 1/Phase 2 Diffie-Hellman Group support: 1, 2, 5, 14 - Dead peer detection - Replay detection - Autokey keep-alive for Phase 2 SA IPsec Configuration Wizard for termination with popular third-party devices |
|---|
| - Block HTTP Post | IPsec VPN deployment modes: Gateway-to-gateway, hub-and-spoke, full mesh, redundant-tunnel, VPN |
|---|
| - Log search keywords | termination in transparent mode, |
|---|
| - Rate images by URL | IPsec VPN Configuration options: Route-based or policy-based |
|---|
| - Web Browsing quota by categories | Other VPN support: L2TP client (on selected models) and server mode, L2TP over IPsec, PPTP, |
|---|
| blocking (IPS) | - Actions: Log only, block, quarantine user/IP/Interface - Predefined filter: Credit card number, Social Security ID DLP file filter: (a text string) and a sensitivity level (Critical, Private, and Warning) hidden in a watermark. Support Windows |
|---|
| Firewall | and Linux free watermarking tools. DLP fingerprinting: Generates a checksum fingerprint from intercepted files and compare it to those in the fingerprint database. DLP archiving: Records full content in email, FTP, IM, NNTP, and web traffic Wireless Controller Manages and provisions settings for local and remote Thin Access points or switches (selected models) Set up access and authentication meth |
|---|
| VPN | portal, 802.1x, preshared keys WiFi Security: Rogue AP suppression, wireless IDS Switch Controller Extends access control and security to wired devices by managing Fortinet switches (FortSwitch) via |
|---|
| Limit SSL portal concurrent users | Ability to configure switch port features such as PoE, VLAN assignment WAN Interface Manager |
|---|
| Endpoint Manager | IPv6 Manages network devices via client software: IPv6 Support: Management over IPv6, IPv6 routing protocols, IPv6 tunnelling, firewall and UTM for IPv6 - Posture checking: Enforce client software installation and desired settings traffic, NAT46, NAT64, IPv6 IPsec VPN - Client configuration provisioning: Push and update client configurations such as VPN and web filtering settings, accordingly to |
|---|
| Token Server | WAN Optimization protocols supported: CIFS, FTP, HTTP(S), MAPI, TCP Integrated token server that provisions and manages physical, SMS, and Soft One Time Password (OTP) tokens Secure Tunneling option: Use AES-128bit-CBC SSL to encrypt the traffic in the WAN optimization tunnel. |
|---|
| Routing / NAT | Tunnel sharing option: Multiple WAN optimization sessions share the same tunnel. Web caching: Object caching that accelerates web applications and web servers by reducing bandwidth |
|---|
| Static and policy routing | usage, server load, and perceived latency. Supports caching of HTTP 1.0 and HTTP 1.1 web sites. |
|---|
| Dynamic routing protocols: | SSL Offloading with Web caching: - RIPv1 and v2, OSPF v2 and v3, ISIS, BGP4 - Full mode: Performs both decryption and encryption of the HTTPS traffic. |
|---|
| Content routing: WCCP and ICAP | - Half mode: Only performs one encryption or decryption action. NAT configuration: Per policy based and central NAT Table Option to exempt certain web sites from web caching with URL patterns. NAT support: NAT64, NAT46, static NAT, dynamic NAT, PAT, Full Cone NAT, STUN Support advanced web caching configurations and options: - Always revalidate, Max cache object zie, negative response duration, f |
|---|
| L2 / Switching | no-cache WAN optimization and web cache monitor Layer-2 interface modes: Port aggregated, loopback, VLANs (802.1Q and Trunking), virtual hardware, |
|---|
| software, and VLAN switches | Explicit Proxy Virtual Wire Pair: Explicit web & FTP proxy: FTP, HTTP, and HTTPS proxying on one or more interfaces - Process traffic only between 2 assigned interfaces on the same network segment - available on both transparent and NAT/route Mode Proxy auto-config (PAC): Provide automatic proxy configurations for explicit web proxy users. - Option to implement wildcard VLANs setup Proxy chaining: |
|---|
| Offline Inspection | Web proxy forwarding server monitoring and health checking Sniffer Mode: An interface can be dedicated to its exclusive use where all traffic entering the interface is IP reflect capability |
|---|
| processed by the sniffer. | Load balancing for forward proxy and proxy chaining Offline Security inspection: AV, Web Filtering, Application Control, IPS, and Anti-spam Explicit web proxy authentication: IP-Based authentication and per session authentication |
|---|
| Hybrid WAN | Server Load Balancing WAN Load balancing (weighted) algorithms: By volume, sessions, source-destination IP and Source IP Traffic can be distributed across multiple backend servers: Usage-based WAN link assignment: Routes new sessions to interfaces that have not reached a configured - Based on multiple methods including static (failover), round robin, weighted or based on round trip time, |
|---|
| bandwidth limit | number of connections. |
|---|
| WAN link checks: | - Supports HTTP, HTTPS, IMAPS, POP3S, SMTPS, SSL or generic TCP/UDP or IP protocols. |
|---|
| - Ping or HTTP probes | Session persistence is supported based on the SSL session ID or based on an injected HTTP cookie. - Monitoring Criterias including latency, jitter, and packet loss - Configurable warning, alert, and failure thresholds Essential Network Services Route Overrides Rules which direct specific traffic based on source/user/usergroups and cloud applications/ Built-in DHCP, NTP, DNS Server, and DNS proxy |
|---|
| policy address objects. | FortiGuard NTP, DDNS, and DNS service |
|---|
| High Availability | Physical Appliance (+ASICs) High availability modes: Active-passive, active-active, virtual clusters, VRRP, FG-5000 series clustering Integrates with ASIC components for traffic processing acceleration. |
|---|
| Redundant heartbeat interfaces | Hypervisor |
|---|
| HA reserved management interface | Support for popular hypervisor platform, including VMware vSphere, Citrix and open source Xen, KVM, and |
|---|
| Failover: | MS hyper-V. - Port, local and remote link monitoring |
|---|
| - Stateful failover | Cloud |
|---|
| - Subsecond failover | Support for public cloud services: Amazon AWS and Microsoft Azure. - Failure detection notification Others Deployment Options: |
|---|
| - HA with link aggregation | Network Vulnerability Scan: Protect network assets (servers and workstations) by scanning them for security |
|---|
| - Full mesh HA | weaknesses. |
|---|
| - Geographically dispersed HA | - On-demand or scheduled |
|---|
| Standalone session synchronization | - Scan Modes: Quick, standard, or full - Authenticated scanning |
|---|
| QoS | - Detailed scan results are logged with direct reference on threat encyclopedia Traffic shaping and QoS per policy or applications: Shared policy shaping, per-IP shaping, maximum and Web Application Firewall: guaranteed bandwidth, maximum concurrent connections per IP, traffic prioritization, Type of Service (TOS), - Signature based, URL constraints and HTTP method policy and Differentiated Servic |
|---|
| Resource | URL |
|---|
| The FortiOS Handbook — The Complete Guide | http://docs.fortinet.com/fgt.html |
|---|
| Fortinet Knowledge Base | http://kb.fortinet.com/ |
|---|
| Product Data Sheets & Matrix | http://www.fortinet.com/resource_center/datasheets.html |
|---|
| GLOBAL HEADQUARTERS | EMEA SALES OFFICE APAC SALES OFFICE LATIN AMERICA SALES OFFICE |
|---|
| Fortinet Inc. | 120 rue Albert Caquot 300 Beach Road 20-01 Prol. Paseo de la Reforma 115 Int. 702 899 Kifer Road 06560, Sophia Antipolis, The Concourse Col. Lomas de Santa Fe, |
|---|
| Sunnyvale, CA 94086 | France Singapore 199555 C.P. 01219 |
|---|
| United States | Tel: +33.4.8987.0510 Tel: +65.6513.3730 Del. Alvaro Obregón |
|---|
| Tel: +1.408.235.7700 | México D.F. |
|---|
| www.fortinet.com/sales | Tel: 011-52-(55) 5524-8480 |
|---|
| FST-PROD-DS-FOS | FOS-DAT-R2-201601 |
|---|
